7 ms·

And to think that posting about Intel ME on HN only a couple years ago would have commenters swarm you with accusations of being a deluded conspiracy theorist.

And to think that posting about Intel ME on HN only a couple years ago would have commenters swarm you with accusations of being a deluded conspiracy theorist. Neat. It's good that people are finally becoming aware of the problems that it poses.

mastax 9y ago
Really? Every thread on HN I've seen about ME has been hordes of people lamenting the fact that you can't buy a processor without it.
- madez 9y ago
  I share GP's opinion. Snowden changed a lot. The internet really has a global passive attacker that can control US-based companies like puppets, and is doing so. William Binney said the companies are paid money for providing data and access. How is that not subsidizing that industry? Financial helps are a first-class reason for other governments to impose duties, restrict international trade and subsidize local competitors. Yet, there is no reaction in Europe. Microsoft can freely sell their OS and Intel is free to have their monopoly, and uses that to backdoor everybody. It is creepy that european countries don't take action. LiMux was a good example of moving in the right direction. Recently it was abandoned. I didn't see big unseen powers at play there, just the harsh reality that most people don't understand computers and don't care.
  - ajross 9y ago
    > global passive attacker that can control US-based companies like puppets, and is doing so. And... this is where the deluded conspiracy theorist accusations the upthread poster was complaining about come from. There's no evidence for any of that[1]. The ME's capabilities (low level system controller with access to all memory and hardware, with special access to network hardware that can operate cleanly along with a running OS) have been known and even advertised by Intel for years. The news of the moment is that it's subject to a few rather embarrassing exploits. But that's rather better explained by incompetance instead of evil. Yet everyone jumps to "back door" because that sounds more fun I guess. (In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME). [1] Edit to clarify: I'm talking about the ME folks. Yes, the government does bad things. The EC flaws under discussion in this subthread are not among them, so citing them as evidence paints you as a conspiracy nut and not someone serious about security.
    - cyphar 9y ago
      > Yet everyone jumps to "back door" because that sounds more fun I guess. IME is (by construction) a backdoor. It's primary purpose is as a management tool, but all management tools are by necessity backdoors. The only distinction between the two is whether the person using the backdoor has ownership over the machine. > In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME. It also shows that the NSA is in communication with Intel and is capable of getting them to implement something that large corporations like Google were unable to convince them to do. Which should be concerning, because it makes you wonder what else the NSA might've asked as well. Also these really aren't conspiracy theories anymore. We know that the NSA and CIA do these sorts of things thanks to the information we learned from Snowden and other whistleblowers.
      - linkregister 9y ago
        No, the Snowden leaks showed that NSA did do something, not that it does every malicious thing that people accuse it of. How does it help anything by making unfounded accusations? Historically, Australia has heavily interfered in PNG affairs. Should you be accused of espionage or subversion if you decide to hike a portion of the Kokoda Trail? Would it be appropriate for Indigenous People to accuse you of attempting to steal their children, a practice that occurred until the 1970s?
        m-p-3 9y ago
        It's hard not to assume the worst, especially when you have no concrete reports on their capabilities. And when assessing the threat it creates, you can't really ignore the possibilities by that lack of knowledge.
        linkregister 9y ago
        But you have tons of concrete reports from the Snowden leaks and prior leaks. Dual_EC RNG is the worst example anyone can think of, something that has been red-flagged since 2007. Assuming a supposedly* adversarial agency has unlimited resources and ability will only cause you to focus on that threat instead of more immediate ones. Or worse, make you needlessly complacent when there is so much that can be done to harden against APTs and other, more immediate threats. * supposedly because if you're a U.S. citizen, the government works for you. If you're outside of FVEY (AU,CA,UK,US,NZ) and are a government official, military member, have interesting technical infrastructure, or operate an interesting company, then yes you should include NSA in your threat model.
  - linkregister 9y ago
    Do you think that the U.S. government has enough money to influence Intel and Microsoft? It is the other way around: both companies spend tens of millions on lobbyists. William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise? Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions? Having a narrow set of news sources can lead a reasonable person (you) to your conclusion. I urge you to look at a variety of sources. Some good ones: Der Spiegel, Al Jazeera, NPR, The Economist, The Wall Street Journal, The South China Morning Post.
    - madez 9y ago
      You ask interesting questions. > Do you think that the U.S. government has enough money to influence Intel and Microsoft? I think the government uses (legal) force and threats to get what they want. The laws are in place to leave no options for the company. The money is more a compensation than a bribery. It could make the companies comply without needing to go nuclear. Also, it supports local companies. > It is the other way around: both companies spend tens of millions on lobbyists. Do these lobbysist have any influence on the FBI, CIA, NSA, etc., either directly or remotely through the government? I don't think so. > William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise? All companies? I don't know, and it doesn't even matter. He talked about his time at the NSA. I consider him a credible source, since I have no reason not to. > Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions? Yes, I think they don't take sufficient and adequate action. The GDPR is a good step, but the race is not won by a step. It reminds me of an anti-corruption office in a one-party communist regime. A good thing, but not enough. Please don't meddle this with taxes. That is a totally different outrageous clusterfuck.
      - linkregister 9y ago
- pwdisswordfish2 9y ago
  "...the fact that you can't buy a processor without it." Not true. "Processor" is a large category and includes much more than Intel's products. As far as we know it is only Intel and a select group of their competitors that offer a ME. There are processors from other sources that do not have a ME, as far as we know. I remember when there was such a diversity of processor architectures in use that programmers had to consider this when writing programs. Nothing stops this diversity from returning except of course a mistaken belief that Intel and its competitors make all processors on planet Earth and this is what users want.
- julian_1 9y ago
  Up until a few weeks ago, people speculated the firmware blobs included a small amount of low-level bootstrap code used to configure IO and to switch from 16 bit to other modes etc. Nobody suggested there was a parallel multi-process operating system running, with full bus arbitration, and mmio capability. Edit. Not sure why I am being downvoted reddit style. Every-time these threads come up - it's necessary to trot out an explanation of the basic differences between ARC core, psp, arm cortex and trustzone etc, and who uses what technology, what is known about the software/OSes that are running - jvm versus minix-os, amt versus ME etc, what is new knowledge, what is official, and what has been uncovered from private research. I base my statements about lack of general awareness on these topics from actually following HN submissions. Just a few days ago, someone in a thread was speculating on using low-level op-codes in bootstrap code to subvert the BIOS, apparently in complete ignorance of the depth of the embedded stack.
  - sounds 9y ago
    Information about the previous CPU architecture on the Intel ME has been widely available for years. It was an ArcCompact CPU running ThreadX: https://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub https://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub
    - julian_1 9y ago
      Where is Minix OS mentioned? How many preemptive processes are running? Which orgs - internal or external to Intel have review-power or signoff on the code running ?
ksk 9y ago
Why would posting about a product that was publicly available and advertised by a company be a conspiracy?
hdhzy 9y ago
You don't need to think ME is a secret NSA backdoor to know it's a terrible "feature" from security point of view.

mastax 9y ago

Really? Every thread on HN I've seen about ME has been hordes of people lamenting the fact that you can't buy a processor without it.

madez 9y ago
I share GP's opinion. Snowden changed a lot. The internet really has a global passive attacker that can control US-based companies like puppets, and is doing so. William Binney said the companies are paid money for providing data and access. How is that not subsidizing that industry? Financial helps are a first-class reason for other governments to impose duties, restrict international trade and subsidize local competitors. Yet, there is no reaction in Europe. Microsoft can freely sell their OS and Intel is free to have their monopoly, and uses that to backdoor everybody. It is creepy that european countries don't take action. LiMux was a good example of moving in the right direction. Recently it was abandoned. I didn't see big unseen powers at play there, just the harsh reality that most people don't understand computers and don't care.
- ajross 9y ago
  > global passive attacker that can control US-based companies like puppets, and is doing so. And... this is where the deluded conspiracy theorist accusations the upthread poster was complaining about come from. There's no evidence for any of that[1]. The ME's capabilities (low level system controller with access to all memory and hardware, with special access to network hardware that can operate cleanly along with a running OS) have been known and even advertised by Intel for years. The news of the moment is that it's subject to a few rather embarrassing exploits. But that's rather better explained by incompetance instead of evil. Yet everyone jumps to "back door" because that sounds more fun I guess. (In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME). [1] Edit to clarify: I'm talking about the ME folks. Yes, the government does bad things. The EC flaws under discussion in this subthread are not among them, so citing them as evidence paints you as a conspiracy nut and not someone serious about security.
  - cyphar 9y ago
    > Yet everyone jumps to "back door" because that sounds more fun I guess. IME is (by construction) a backdoor. It's primary purpose is as a management tool, but all management tools are by necessity backdoors. The only distinction between the two is whether the person using the backdoor has ownership over the machine. > In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME. It also shows that the NSA is in communication with Intel and is capable of getting them to implement something that large corporations like Google were unable to convince them to do. Which should be concerning, because it makes you wonder what else the NSA might've asked as well. Also these really aren't conspiracy theories anymore. We know that the NSA and CIA do these sorts of things thanks to the information we learned from Snowden and other whistleblowers.
    - linkregister 9y ago
      No, the Snowden leaks showed that NSA did do something, not that it does every malicious thing that people accuse it of. How does it help anything by making unfounded accusations? Historically, Australia has heavily interfered in PNG affairs. Should you be accused of espionage or subversion if you decide to hike a portion of the Kokoda Trail? Would it be appropriate for Indigenous People to accuse you of attempting to steal their children, a practice that occurred until the 1970s?
      - m-p-3 9y ago
        It's hard not to assume the worst, especially when you have no concrete reports on their capabilities. And when assessing the threat it creates, you can't really ignore the possibilities by that lack of knowledge.
        linkregister 9y ago
        But you have tons of concrete reports from the Snowden leaks and prior leaks. Dual_EC RNG is the worst example anyone can think of, something that has been red-flagged since 2007. Assuming a supposedly* adversarial agency has unlimited resources and ability will only cause you to focus on that threat instead of more immediate ones. Or worse, make you needlessly complacent when there is so much that can be done to harden against APTs and other, more immediate threats. * supposedly because if you're a U.S. citizen, the government works for you. If you're outside of FVEY (AU,CA,UK,US,NZ) and are a government official, military member, have interesting technical infrastructure, or operate an interesting company, then yes you should include NSA in your threat model.
- linkregister 9y ago
  Do you think that the U.S. government has enough money to influence Intel and Microsoft? It is the other way around: both companies spend tens of millions on lobbyists. William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise? Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions? Having a narrow set of news sources can lead a reasonable person (you) to your conclusion. I urge you to look at a variety of sources. Some good ones: Der Spiegel, Al Jazeera, NPR, The Economist, The Wall Street Journal, The South China Morning Post.
  - madez 9y ago
    You ask interesting questions. > Do you think that the U.S. government has enough money to influence Intel and Microsoft? I think the government uses (legal) force and threats to get what they want. The laws are in place to leave no options for the company. The money is more a compensation than a bribery. It could make the companies comply without needing to go nuclear. Also, it supports local companies. > It is the other way around: both companies spend tens of millions on lobbyists. Do these lobbysist have any influence on the FBI, CIA, NSA, etc., either directly or remotely through the government? I don't think so. > William Binney said something. Does it mean that it applies to all companies? Did he mention which companies? Is he a credible source for things that occurred after he left NSA? Is he even a credible source outside his expertise? All companies? I don't know, and it doesn't even matter. He talked about his time at the NSA. I consider him a credible source, since I have no reason not to. > Do you think that European countries don't take action? What would you call the anti-trust suit against Google, GDPR, anti-tax haven lawsuit against Apple, and other actions? Yes, I think they don't take sufficient and adequate action. The GDPR is a good step, but the race is not won by a step. It reminds me of an anti-corruption office in a one-party communist regime. A good thing, but not enough. Please don't meddle this with taxes. That is a totally different outrageous clusterfuck.
    - linkregister 9y ago
pwdisswordfish2 9y ago
"...the fact that you can't buy a processor without it." Not true. "Processor" is a large category and includes much more than Intel's products. As far as we know it is only Intel and a select group of their competitors that offer a ME. There are processors from other sources that do not have a ME, as far as we know. I remember when there was such a diversity of processor architectures in use that programmers had to consider this when writing programs. Nothing stops this diversity from returning except of course a mistaken belief that Intel and its competitors make all processors on planet Earth and this is what users want.
julian_1 9y ago
Up until a few weeks ago, people speculated the firmware blobs included a small amount of low-level bootstrap code used to configure IO and to switch from 16 bit to other modes etc. Nobody suggested there was a parallel multi-process operating system running, with full bus arbitration, and mmio capability. Edit. Not sure why I am being downvoted reddit style. Every-time these threads come up - it's necessary to trot out an explanation of the basic differences between ARC core, psp, arm cortex and trustzone etc, and who uses what technology, what is known about the software/OSes that are running - jvm versus minix-os, amt versus ME etc, what is new knowledge, what is official, and what has been uncovered from private research. I base my statements about lack of general awareness on these topics from actually following HN submissions. Just a few days ago, someone in a thread was speculating on using low-level op-codes in bootstrap code to subvert the BIOS, apparently in complete ignorance of the depth of the embedded stack.
- sounds 9y ago
  Information about the previous CPU architecture on the Intel ME has been widely available for years. It was an ArcCompact CPU running ThreadX: https://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub https://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub
  - julian_1 9y ago
    Where is Minix OS mentioned? How many preemptive processes are running? Which orgs - internal or external to Intel have review-power or signoff on the code running ?

ksk 9y ago

Why would posting about a product that was publicly available and advertised by a company be a conspiracy?

hdhzy 9y ago

You don't need to think ME is a secret NSA backdoor to know it's a terrible "feature" from security point of view.